Privacy Policy | ChangeApp

1. Introduction

Welcome to ChangeApp.

ChangeApp is a digital payment and change collection platform operated by Chaingapp Limited ("ChangeApp", "Company", "we", "us", or "our").

We are committed to protecting the privacy, confidentiality, and security of personal information entrusted to us by customers, merchants, website visitors, and other users of our Services.

This Privacy Policy explains how we collect, use, process, store, disclose, share, retain, and protect personal information when you access or use our website, mobile applications, digital wallets, payment features, and related services (collectively, the "Services").

Certain banking services available through ChangeApp are provided by VFD Microfinance Bank under a Banking-as-a-Service (BaaS) partnership with Chaingapp Limited.

This Policy also explains how personal information may be shared with VFD Microfinance Bank to facilitate bank account creation, identity verification, banking transactions, and regulatory compliance.

We process personal information in accordance with the Nigeria Data Protection Act 2023 and other applicable Nigerian laws and regulations.

By using ChangeApp, you acknowledge that you have been informed of the data processing practices described in this Policy. Where consent is legally required, we will obtain it separately.

2. About ChangeApp and Our Banking Partnership

ChangeApp provides digital tools that enable customers and participating merchants to give, receive, accumulate, transfer, and use money electronically.

Depending on account eligibility and available functionality, our Services may include:

Digital collection of cash change.
ChangeApp wallet creation and management.
Payments between ChangeApp users.
Payments to participating merchants.
Wallet funding through supported channels.
Withdrawal requests to bank accounts.
QR-code and supported USSD transaction features.
Transaction records and notifications.
Access to supported banking services through our banking partner.

2.1 ChangeApp's Role

Chaingapp Limited operates the ChangeApp platform, including its website, mobile applications, user interface, digital change collection functionality, merchant experience, and related technology services.

ChangeApp also facilitates access to supported banking services through its integration with VFD Microfinance Bank.

2.2 VFD Microfinance Bank's Role

Under our BaaS partnership, VFD Microfinance Bank provides the underlying regulated banking infrastructure for supported services, including:

Creation of eligible bank accounts.
Banking account verification.
Supported bank transfers.
Banking transaction processing.
Other banking functions made available through the partnership.

Users may access these services through the ChangeApp application without separately navigating to VFD's banking application.

2.3 Sharing Information With VFD

To provide these integrated services, ChangeApp may securely transmit relevant personal, identification, account, and transaction information to VFD Microfinance Bank.

VFD may use this information to open and manage eligible accounts, verify customers, process transactions, prevent fraud, maintain banking records, and comply with applicable regulatory obligations.

Chaingapp Limited and VFD Microfinance Bank may each have independent data protection responsibilities depending on the particular processing activity and their contractual and legal obligations.

3. Information We Collect

We collect information reasonably necessary to operate ChangeApp, facilitate banking services, protect users, process transactions, and comply with applicable laws.

3.1 Personal Identification Information

We may collect:

Full name.
Phone number.
Email address.
Date of birth.
Residential address.
Gender, where required for verification.
Account registration information.
Profile information.
Government-issued identification details.
Bank Verification Number (BVN).
National Identification Number (NIN).
Other information required for applicable Know Your Customer (KYC) verification.

The information requested may depend on your account type, verification tier, and the banking services you wish to access.

3.2 Banking and Account Information

Where you access banking services through our VFD partnership, we may collect or process:

Information submitted for bank account creation.
Bank account numbers and account names.
Account verification status.
Assigned account verification tier.
Banking transaction references.
Beneficiary account details.
Bank transfer instructions.
Banking transaction confirmations.
Information relating to account restrictions or verification requirements.

Some of this information may be received from VFD Microfinance Bank or other authorised banking service providers.

3.3 Wallet and Transaction Information

We may collect:

ChangeApp wallet details.
Wallet balances.
Digital change collection records.
Payment amounts.
Transaction dates and times.
Sender and recipient information.
Merchant transaction information.
Wallet funding records.
Withdrawal requests.
Transaction references and statuses.
Failed, disputed, reversed, or cancelled transaction records.

3.4 Merchant Information

For merchants, we may collect:

Business or trading name.
Business contact information.
Business address, where required.
Business category.
Business registration information, where applicable.
Information about authorised representatives.
Merchant identity verification records.
Merchant transaction information.
Other information reasonably required for business verification and compliance.

3.5 Device and Technical Information

When you use our website or applications, we may collect:

Device type and model.
Operating system.
Browser information.
IP address.
Application version.
Device identifiers, where permitted.
Login and session records.
Security logs.
Application diagnostics.
Crash reports.
General usage information.

3.6 Customer Support Information

When you contact us, we may collect:

Your contact details.
Support messages.
Complaints and enquiries.
Transaction references.
Documents submitted to resolve an issue.
Records of our communications.

3.7 Location Information

We may process approximate location information derived from technical data for security, fraud prevention, and operational purposes.

Where a feature requires precise device location, we will request the relevant permission and provide appropriate information about its use.

3.8 Cookies and Similar Technologies

Our website may use cookies and similar technologies for essential functionality, authentication, security, preferences, performance monitoring, and analytics where implemented.

Where legally required, we will obtain consent before using non-essential cookies or tracking technologies.

4. Account Verification and Tier-Based KYC

ChangeApp supports access to banking services that may be subject to tier-based customer verification requirements.

Users may be classified under Tier 1, Tier 2, or Tier 3, depending on their verification status, account eligibility, and applicable banking requirements.

4.1 Tier 1 Verification

Tier 1 onboarding may require basic personal information and verification using a valid BVN or NIN, together with other information required by VFD Microfinance Bank and applicable regulations.

4.2 Tier 2 Verification

Tier 2 verification may require additional identity information, supporting documentation, and verification checks.

Applicable BVN and NIN requirements must be satisfied in accordance with relevant banking regulations.

4.3 Tier 3 Verification

Tier 3 verification may require further identity, address, and supporting documentation, together with any additional checks required for higher-tier banking services.

4.4 Verification Through VFD

Information submitted for account creation or tier upgrades may be shared with VFD Microfinance Bank for:

Identity verification.
Banking account creation.
Customer due diligence.
Tier classification and upgrades.
Fraud prevention.
Compliance with banking regulations.

The exact information required for each tier may change in accordance with applicable law and VFD's verification requirements.

Users who do not provide required information may be unable to access certain banking features or complete an account upgrade.

5. How We Collect Personal Information

We may collect information through:

5.1 Information You Provide

Information submitted when you register, verify your identity, create a wallet, request banking services, make transactions, update your account, or contact support.

5.2 Automated Collection

Technical information collected through your use of our website and applications, including session records, device information, and security-related activity.

5.3 Other ChangeApp Users

Information provided by merchants, customers, or other users involved in transactions with you.

5.4 VFD Microfinance Bank

Information returned through our banking integration, including account creation outcomes, verification status, account details, transaction confirmations, and relevant banking records.

5.5 Other Authorised Third Parties

Information received from payment processors, identity verification providers, fraud prevention services, telecommunications providers, and other relevant service providers where lawful.

6. How We Use Personal Information

We process personal information for legitimate purposes connected with operating ChangeApp and providing integrated banking services.

These purposes include:

6.1 Account Registration and Management

Creating user and merchant profiles.
Managing accounts.
Authenticating users.
Updating account details.
Providing account support.

6.2 Banking Account Creation

Submitting required information to VFD Microfinance Bank.
Facilitating eligible bank account creation.
Receiving account creation confirmations.
Displaying supported banking details within ChangeApp.
Managing banking integration processes.

6.3 Identity Verification

Performing KYC checks.
Supporting Tier 1, Tier 2, and Tier 3 verification.
Validating identity information.
Supporting account upgrades.
Meeting applicable regulatory requirements.

6.4 Payments and Transactions

Facilitating digital change collection.
Processing supported wallet transfers.
Enabling merchant payments.
Facilitating wallet funding.
Submitting bank transfer and withdrawal instructions.
Recording transaction histories.
Providing payment confirmations.

6.5 Security and Fraud Prevention

Detecting suspicious activity.
Preventing unauthorised account access.
Identifying potential fraud.
Investigating disputed transactions.
Protecting user accounts and platform infrastructure.

6.6 Regulatory Compliance

Supporting applicable banking compliance requirements.
Maintaining legally required records.
Responding to lawful regulatory requests.
Assisting with anti-money laundering and counter-terrorism financing controls.

6.7 Communications

Sending transaction notifications.
Communicating account and security updates.
Responding to enquiries.
Providing information about service interruptions or material changes.

6.8 Service Improvement

Diagnosing technical issues.
Improving reliability and performance.
Understanding platform usage.
Developing and improving features.

6.9 Marketing

We may send promotional communications where permitted by law.

Where consent is required, we will obtain it. Users may opt out of non-essential marketing communications.

7. Legal Bases for Processing

Depending on the processing activity, we may rely on:

Performance of a Contract: Processing necessary to provide requested ChangeApp services and facilitate supported banking functionality.

Compliance With Legal Obligations: Processing required under applicable financial services, identity verification, anti-money laundering, data protection, and other laws.

Legitimate Interests: Processing necessary for fraud prevention, platform security, operational improvement, and dispute resolution, subject to applicable safeguards.

Consent: Processing for which consent is required, including certain marketing, optional tracking, or other activities requiring specific authorisation.

Other Lawful Grounds: Any other lawful basis recognised under applicable Nigerian data protection legislation.

Where processing relies on consent, users may withdraw that consent, subject to applicable legal requirements.

8. Sharing Personal Information

We do not sell users' personal information to advertisers or data brokers.

We may disclose information to appropriate third parties for lawful and necessary purposes.

8.1 VFD Microfinance Bank

VFD Microfinance Bank is a principal banking partner of ChangeApp.

We may share information with VFD for:

Bank account creation.
Customer identity verification.
Tier-based KYC processing.
Account upgrades.
Banking transaction processing.
Bank transfers and withdrawals.
Transaction reconciliation.
Fraud prevention.
Regulatory compliance.
Banking complaints and investigations.

Information shared may include personal identification details, BVN, NIN, account information, transaction records, and other information reasonably required for the relevant banking service.

VFD may independently retain and process information where required to fulfil its obligations as a regulated financial institution.

8.2 Other Banks and Payment Providers

We may share relevant information with other authorised financial institutions and payment providers where necessary to complete transactions or support payment services.

8.3 Identity Verification Providers

We may share information with authorised verification providers for identity checks, fraud prevention, and compliance purposes.

8.4 Other Users and Merchants

Limited transaction information may be disclosed to relevant senders, recipients, or merchants to confirm payments and support transaction records.

8.5 Technology and Operational Providers

We may share information with service providers supporting hosting, security, communications, customer support, infrastructure, and technical operations.

8.6 Regulatory and Law Enforcement Authorities

We may disclose information in response to lawful requests or where disclosure is required by applicable law.

8.7 Business Transfers

Information may be transferred as part of a lawful merger, acquisition, restructuring, or business transfer, subject to applicable safeguards.

9. Data Protection Responsibilities of ChangeApp and VFD

Chaingapp Limited is responsible for personal information it controls in connection with the operation of the ChangeApp platform.

VFD Microfinance Bank may separately determine the purposes and means of processing information necessary to provide regulated banking services and meet its own legal obligations.

Depending on the activity, Chaingapp Limited and VFD may act as separate data controllers or operate under another lawful data processing arrangement.

Users may therefore have privacy rights that can be exercised in relation to information processed by either organisation, as applicable.

For enquiries concerning information submitted through ChangeApp, users may initially contact support@changeapp.ng.

Where an enquiry relates to information independently controlled by VFD, ChangeApp may coordinate with VFD or direct the user to the appropriate privacy contact.

10. Data Security

We implement reasonable technical and organisational measures designed to protect personal information.

These may include:

Secure authentication.
Access controls.
Encryption where appropriate.
Secure communication protocols.
Transaction verification.
Security monitoring.
Incident response procedures.
Restricted access to sensitive information.

Information exchanged with VFD and other authorised service providers is handled through applicable technical and security arrangements.

We require service providers processing information on our behalf to maintain appropriate confidentiality and security safeguards.

However, no electronic system can be guaranteed to be completely secure.

Users should protect their passwords, transaction PINs, verification codes, and account credentials.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required by applicable law.

Retention may depend on:

Account status.
Transaction recordkeeping requirements.
Banking and KYC obligations.
Anti-money laundering requirements.
Fraud prevention.
Dispute resolution.
Legal or regulatory investigations.

VFD Microfinance Bank may independently retain banking and identity verification records where required by its own regulatory obligations.

Closing a ChangeApp account does not automatically require immediate deletion of all banking records held by VFD.

Where information is no longer required, we will take appropriate steps to delete, anonymise, or securely dispose of it.

12. Your Data Protection Rights

Subject to applicable law, users may have the following rights:

12.1 Right to Be Informed

To receive information about how personal information is processed.

12.2 Right of Access

To request access to personal information held about them.

12.3 Right to Rectification

To request correction of inaccurate or incomplete information.

12.4 Right to Erasure

To request deletion of information where legally appropriate.

12.5 Right to Restrict Processing

To request restrictions on certain processing activities where applicable.

12.6 Right to Object

To object to qualifying processing activities, including direct marketing.

12.7 Right to Withdraw Consent

To withdraw consent where processing relies on consent.

12.8 Right to Data Portability

To request information in a structured, commonly used, machine-readable format where applicable.

12.9 Rights Relating to Automated Decisions

To exercise applicable rights concerning qualifying automated decision-making.

12.10 Right to Complain

To lodge a complaint with the Nigeria Data Protection Commission or another competent authority.

To exercise your rights, contact:

support@changeapp.ng

We may request reasonable identity verification before responding.

13. International Data Transfers

Some service providers supporting ChangeApp may process or store personal information outside Nigeria.

Where international transfers occur, we will comply with applicable Nigerian data protection requirements and implement appropriate safeguards.

Such safeguards may include contractual protections, recognised transfer mechanisms, and appropriate security arrangements.

14. Children's Privacy

ChangeApp's wallet and integrated banking services are intended for individuals aged 18 years or older.

We do not knowingly permit individuals under 18 to independently register for and operate ChangeApp accounts.

Where we become aware of an account registered contrary to this requirement, we may restrict or close the account and handle associated information in accordance with applicable law.

Parents or guardians may contact support@changeapp.ng regarding suspected unauthorised registration by a minor.

15. Automated Fraud Detection

We may use automated systems to identify suspicious transactions, unusual account activity, or potential security risks.

These systems may support:

Fraud detection.
Transaction monitoring.
Security alerts.
Additional verification requests.
Referral of suspicious activity for review.

Where applicable law provides rights concerning solely automated decisions, we will comply with those requirements.

16. Third-Party Services

Some ChangeApp features rely on third-party financial, telecommunications, identity verification, and technology providers.

Such providers may maintain their own privacy policies and legal obligations.

We encourage users to review applicable third-party privacy notices where provided.

Nothing in this Policy excludes Chaingapp Limited's own legal responsibilities.

17. Account Closure and Data Deletion

Users may request account closure through an available application feature or by contacting support@changeapp.ng.

Before closing an account, we may need to:

Verify the account holder's identity.
Resolve pending transactions.
Investigate outstanding disputes.
Facilitate the handling of eligible remaining funds.
Coordinate applicable banking account closure procedures with VFD.
Satisfy legal and regulatory requirements.

Where a ChangeApp account is linked to a VFD banking account, closure of the ChangeApp profile does not necessarily result in immediate closure of the underlying banking account.

Any applicable banking account closure process will be handled in accordance with the relevant banking arrangements and legal requirements.

Information no longer required will be deleted, anonymised, or securely disposed of as appropriate.

18. Personal Data Breaches

We take personal data breaches seriously.

Where a breach occurs, we will investigate, assess the potential impact, and take appropriate remedial measures.

Where required by applicable law, we will notify the Nigeria Data Protection Commission and affected individuals within the prescribed timelines.

Where a breach involves shared banking information, we may coordinate with VFD Microfinance Bank and other relevant service providers.

19. Changes to This Privacy Policy

We may update this Policy to reflect:

Changes to ChangeApp services.
Changes to banking integrations.
New verification requirements.
Changes in data processing practices.
Security improvements.
Legal or regulatory developments.

Updated versions will be published on our website with a revised "Last Updated" date.

Where required, we will provide additional notice or obtain appropriate consent.

20. Complaints and Regulatory Rights

If you have concerns about how ChangeApp handles your personal information, please contact:

support@changeapp.ng

We will review complaints and seek to resolve them in accordance with applicable legal requirements.

Where a complaint concerns banking-related personal information processed by VFD Microfinance Bank, we may coordinate with VFD to facilitate an appropriate response.

Users may also lodge complaints with the Nigeria Data Protection Commission or pursue other remedies available under applicable law.

21. Contact Information

For questions, privacy requests, complaints, legal notices, or other enquiries concerning this Privacy Policy, please contact:

CHANGEAPP

Legal Entity: Chaingapp Limited

Email: support@changeapp.ng

Website: https://www.changeapp.ng